Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
11 months ago
Solved

Azure Maps visual with URL access

Hi, I am trying to implement the URL option for my geojson reference layer in Azure Maps. I need this access method to quickly switch between reference layer files which contain big volumes of data ...
Need Help
Anonymous's avatar
Anonymous
Not applicable
11 months ago

Hi v-dineshya 

 

Thank you for the reply! I have not managed to get the SAS token to work despite that I input it on the format you propose - which is also the exact same format which I copy it from the creation of it in Azure Portal. However, since my client has installed a gateway connection between Power BI and the storage account they are okay with us accessing the reference map without a SAS token. 

However, I am still curious as to why it does not work with the token. Could you give me a sample URL with a bit more detail on the token/structure so I can confirm it matches my own?

v-dineshya's avatar
v-dineshya
Community Support
11 months ago

Hi Anonymous ,

Please refer below sample valid SAS token URL structure for Azure Blob Storage that should work with Azure Maps in Power BI.

 

https://<storage-account>.blob.core.windows.net/<container>/<file>.geojson?


sv=2022-11-02
&st=2025-09-05T12:00:00Z
&se=2025-09-05T20:00:00Z
&sr=b
&sp=r
&sig=AbCdEfGhIjKlMnOpQrStUvWxYz1234567890%2Fabcdefg%3D


sv --> Storage service version (e.g 2022-11-02)
st --> Start time (UTC) when the SAS becomes valid
se --> Expiry time (UTC) when the SAS expires
sr --> Resource type (b for blob, c for container)
sp --> Permissions (r for read)
sig --> HMAC-SHA256 signature generated using the storage account key

 

Note: Check the URL is accessed over HTTPS, and the blob is not set to public access if you are relying solely on the SAS token for security.


Please try below additional Security things.

 

1. Use User Delegation SAS, It is more secure than account-level SAS. Tied to Azure AD identities. Requires role assignment for Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey.

 

2. Use the sip parameter to restrict access to specific IP ranges.

 

3. Use spr=https to enforce HTTPS-only access.


Please refer below sample SAS Token URL Structure with all security parameters.

 

https://mysecurestorage.blob.core.windows.net/mapsdata/india.geojson?
sv=2022-11-02
&st=2025-09-05T12:00:00Z
&se=2025-09-05T14:00:00Z
&sr=b
&sp=r
&sip=203.0.113.0-203.0.113.255
&spr=https
&sig=AbCdEfGhIjKlMnOpQrStUvWxYz1234567890%2Fabcdefg%3D

 

Please refer below Microsoft official documents.

Create shared access signature (SAS) tokens for storage containers and blobs - Azure AI services | Microsoft Learn

Service SAS examples - Azure Storage | Microsoft Learn

Grant limited access to data with shared access signatures (SAS) - Azure Storage | Microsoft Learn

 

I hope this information helps. Please do let us know if you have any further queries.

 

Regards,

Dinesh